Claude Skills by chrishuffman5

Expert agent for Akamai Guardicore micro-segmentation (formerly Guardicore Centra). Covers agent and agentless deployment, real-time visibility map, process-level segmentation policies, deception honeypots, east-west traffic analysis, label-based policy, and Guardicore Centra platform. WHEN: \"Guardicore\", \"Akamai Guardicore\", \"Guardicore Centra\", \"Guardicore micro-segmentation\", \"Guardicore deception\", \"process-level segmentation\", \"Guardicore visibility map\", \"Guardicore polic...

Routing agent for Identity & Access Management technologies. Covers SSO, MFA, federation, provisioning, governance, and cross-platform IAM architecture. WHEN: \"IAM\", \"identity management\", \"access management\", \"SSO\", \"MFA\", \"federation\", \"SCIM provisioning\", \"identity governance\", \"access review\", \"zero trust identity\". Do NOT use for platform-specific questions -- use the `entra-id`, `okta`, `ad-ds`, `auth0`, `keycloak`, `ad-fs`, `ad-cs`, `ping-identity`, `aws-iam`, `gcp-...

Expert agent for Illumio micro-segmentation platform. Covers Policy Compute Engine (PCE), Virtual Enforcement Node (VEN) agents, label-based policy model (role/app/environment/location), application dependency mapping, enforcement boundaries, ring-fencing, Illumio CloudSecure, and workload segmentation. WHEN: \"Illumio\", \"Illumio PCE\", \"VEN agent\", \"micro-segmentation\", \"Illumio policy\", \"workload segmentation\", \"enforcement boundary\", \"application dependency map\", \"Illumio Cl...

Expert agent for Infisical open-source secrets manager. Covers self-hosted and cloud deployments, dynamic secrets, internal PKI, secret rotation, RBAC, Kubernetes operator, Terraform provider, and CLI. WHEN: \"Infisical\", \"Infisical self-hosted\", \"Infisical operator\", \"Infisical dynamic secrets\", \"Infisical PKI\", \"Infisical CLI\", \"infisical run\", \"Infisical secret rotation\".

Expert agent for Keycloak open-source identity platform. Provides deep expertise in realms, clients, identity brokering, user federation, fine-grained authorization, Organizations, themes, and Quarkus-based deployment. WHEN: \"Keycloak\", \"realm\", \"identity brokering\", \"Keycloak client\", \"Keycloak federation\", \"Keycloak themes\", \"Keycloak authorization\", \"Keycloak Quarkus\", \"Keycloak Organizations\".

Expert agent for Let's Encrypt free TLS certificates via ACME. Covers certbot, acme.sh, HTTP-01/DNS-01/TLS-ALPN-01 challenges, 90-day and 6-day certificate lifetimes, wildcard certificates, rate limits, staging environment, and automation best practices. WHEN: \"Let's Encrypt\", \"certbot\", \"acme.sh\", \"ACME\", \"free TLS\", \"LEGO\", \"Certify The Web\", \"short-lived certificate\", \"6-day certificate\", \"ACME challenge\", \"DNS-01 challenge\".

Expert agent for CrowdStrike Falcon LogScale (formerly Humio). Provides deep expertise in LQL query development, index-free streaming architecture, real-time search, Falcon EDR integration, bloom filters, data compression, community edition, and high-volume log analytics. WHEN: \"LogScale\", \"Falcon LogScale\", \"Humio\", \"LQL\", \"LogScale query\", \"streaming SIEM\", \"index-free\", \"CrowdStrike SIEM\", \"LogScale community\".

Expert agent for Mandiant Threat Intelligence (Google). Covers APT/UNC actor tracking, Advantage platform modules, breach analytics, Attack Surface Management, Digital Threat Monitoring, Security Validation, Google SecOps/Chronicle integration, and Mandiant IR consulting expertise. WHEN: \"Mandiant\", \"Google Threat Intelligence\", \"GTI\", \"Advantage\", \"APT group\", \"UNC group\", \"breach analytics\", \"Mandiant IR\", \"FireEye\", \"Mandiant Academy\".

Expert agent for Mend (formerly WhiteSource) enterprise SCA platform. Covers dependency scanning, license compliance, vulnerability management, Renovate bot integration, SBOM export, and CI/CD integration. WHEN: \"Mend\", \"WhiteSource\", \"Mend SCA\", \"mend.io\", \"Renovate\", \"Renovate bot\", \"WhiteSource bolt\", \"Mend for Containers\".

Expert agent for Mimecast Email Security. Covers SEG, targeted threat protection, email continuity, DMARC analyzer, awareness training, and archiving/compliance. WHEN: \"Mimecast\", \"Mimecast SEG\", \"Mimecast URL protection\", \"Mimecast impersonation\", \"Mimecast continuity\", \"Mimecast DMARC\", \"Mimecast archive\", \"Mimecast awareness training\".

Expert agent for MISP (Malware Information Sharing Platform). Covers events, attributes, objects, galaxies, taxonomies, correlation engine, sharing groups, feeds, PyMISP, STIX/TAXII export, warninglists, and misp-modules enrichment. WHEN: \"MISP\", \"Malware Information Sharing Platform\", \"MISP event\", \"MISP feed\", \"PyMISP\", \"MISP galaxy\", \"MISP taxonomy\", \"MISP object\", \"sharing group\", \"misp-modules\".

Expert agent for Netskope One SSE/SASE. Covers NewEdge infrastructure, CASB (40K+ apps), SWG, ZTNA Next, ML-powered DLP, UEBA, and Advanced Analytics. WHEN: \"Netskope\", \"Netskope CASB\", \"Netskope SWG\", \"Netskope ZTNA\", \"NewEdge\", \"Netskope DLP\", \"Netskope UEBA\", \"Netskope One\", \"Netskope inline\", \"Netskope tenant\".

Routing agent for network security technologies including IDS/IPS, NAC, and micro-segmentation. Cross-platform expertise in detection methodology, network visibility, east-west vs north-south traffic, and network forensics. WHEN: \"IDS\", \"IPS\", \"NAC\", \"network access control\", \"micro-segmentation\", \"network detection\", \"east-west traffic\", \"lateral movement detection\", \"network visibility\", \"Suricata\", \"Snort\", \"Zeek\", \"Cisco ISE\", \"ClearPass\", \"FortiNAC\", \"Illum...

Expert agent for Okta identity platform. Provides deep expertise in Universal Directory, Adaptive MFA, Lifecycle Management, Workflows, API Access Management, ThreatInsight, and Identity Governance. WHEN: \"Okta\", \"Universal Directory\", \"OIN\", \"Okta Workflows\", \"Okta MFA\", \"Okta SSO\", \"ThreatInsight\", \"Okta Lifecycle\", \"Okta SCIM\", \"Okta API Access Management\".

Expert agent for OneTrust GRC and privacy management. Covers privacy program management (GDPR, CCPA, DSAR automation, consent management, data mapping/RoPA), tech risk management, third-party risk, AI governance, and ethics and compliance. WHEN: \"OneTrust\", \"consent management\", \"DSAR automation\", \"data mapping\", \"RoPA\", \"OneTrust privacy\", \"OneTrust vendor risk\", \"AI governance OneTrust\", \"OneTrust GRC\".

Expert agent for Orca Security CNAPP platform. Covers agentless SideScanning technology, CSPM, CWPP, CIEM, DSPM, API security, AI-SPM, risk prioritization, and shift-left CI/CD integration. WHEN: \"Orca Security\", \"Orca SideScan\", \"Orca CNAPP\", \"Orca cloud security\", \"Orca risk score\", \"Orca CSPM\", \"Orca image scanning\", \"Orca shift left\".

Top-level routing agent for ALL security technologies and disciplines. Provides cross-domain expertise in security architecture, risk assessment, defense-in-depth, compliance frameworks, and threat modeling. WHEN: \"security architecture\", \"threat model\", \"NIST CSF\", \"MITRE ATT&CK\", \"defense in depth\", \"zero trust\", \"security assessment\", \"compliance framework\", \"CIS benchmarks\", \"incident response\", \"security posture\", \"attack surface\", \"risk management\", \"security ...

Expert agent for Ping Identity platform. Provides deep expertise in PingOne cloud, PingFederate, PingAccess, PingDirectory, DaVinci orchestration, PingOne Protect, and PingOne Neo decentralized identity. WHEN: \"Ping Identity\", \"PingFederate\", \"PingOne\", \"PingAccess\", \"PingDirectory\", \"DaVinci\", \"PingOne Protect\", \"PingOne Neo\", \"Ping SSO\", \"Ping federation\".

Routing agent for PKI and Certificate Lifecycle Management. Delegates to Let's Encrypt, Venafi, DigiCert, cert-manager, EJBCA, and smallstep specialists. Handles PKI design, CA hierarchy, X.509 concepts, ACME protocol, and certificate automation strategy. WHEN: \"PKI\", \"certificate authority\", \"CA hierarchy\", \"TLS certificate\", \"certificate lifecycle\", \"ACME\", \"X.509\", \"certificate rotation\", \"certificate renewal\", \"CLM\", \"machine identity\". Do NOT use for vendor-specific...

Expert agent for Palo Alto Networks Prisma Access and SASE. Covers ZTNA 2.0, GlobalProtect agent, cloud FWaaS, ADEM digital experience, CASB, and Prisma SD-WAN integration. WHEN: \"Prisma Access\", \"Palo Alto SASE\", \"GlobalProtect\", \"ZTNA 2.0\", \"Prisma SD-WAN\", \"ADEM\", \"Palo Alto cloud firewall\", \"Strata Cloud Manager\", \"Panorama SASE\".

Expert agent for Palo Alto Prisma Cloud / Cortex Cloud CNAPP platform. Covers CSPM, CWPP Defender agents, CIEM, DSPM, code-to-cloud pipeline security, AppDNA, and Cortex XDR convergence. WHEN: \"Prisma Cloud\", \"Cortex Cloud\", \"Prisma Cloud Defender\", \"CWPP Defender\", \"AppDNA\", \"Prisma CSPM\", \"Prisma CIEM\", \"code-to-cloud\", \"Prisma IaC\", \"Prisma runtime\", \"Palo Alto cloud security\".

Expert agent for Proofpoint Email Protection. Covers SEG, Targeted Attack Protection, URL Defense, Very Attacked People, TRAP post-delivery remediation, and email DLP. WHEN: \"Proofpoint\", \"Proofpoint SEG\", \"TAP\", \"Targeted Attack Protection\", \"URL Defense\", \"TRAP\", \"Nexus People Risk\", \"Very Attacked People\", \"VAP\", \"Proofpoint quarantine\", \"Proofpoint DLP\".

Expert agent for Microsoft Purview DLP. Covers sensitive info types, trainable classifiers, exact data match, endpoint DLP, M365 policy configuration, Adaptive Protection, Copilot/AI Hub leak prevention, and Activity Explorer. WHEN: \"Purview DLP\", \"M365 DLP\", \"sensitivity labels\", \"trainable classifier\", \"exact data match\", \"endpoint DLP\", \"compliance portal\", \"Activity Explorer\", \"Copilot DLP\", \"MIP\".

Expert agent for IBM QRadar SIEM. Provides deep expertise in AQL query development, offense management, DSM configuration, event pipeline tuning, custom rule building, reference sets/maps, Ariel database, and on-premises deployment architecture. WHEN: \"QRadar\", \"AQL\", \"Ariel query\", \"QRadar offense\", \"DSM\", \"QRadar rule\", \"building block\", \"reference set\", \"QRadar tuning\", \"IBM SIEM\".

Expert agent for Qualys VMDR, TotalCloud, and the Qualys Cloud Platform. Covers Cloud Agent, scanner appliances, QQL, asset groups, TruRisk scoring, VMDR workflows, TotalCloud CNAPP, WAS, and Policy Compliance. WHEN: \"Qualys\", \"VMDR\", \"QQL\", \"Qualys Cloud Agent\", \"TruRisk\", \"TotalCloud\", \"Qualys scanner appliance\", \"Qualys CSAM\", \"Qualys WAS\", \"CSAM\".

Expert agent for Rapid7 InsightVM. Covers console and distributed scan engine architecture, Insight Agent, Active Risk scoring, Remediation Hub, asset groups, SQL-like query for assets, dashboards, Metasploit integration, and InsightConnect SOAR automation. WHEN: \"Rapid7\", \"InsightVM\", \"Nexpose\", \"Insight Agent\", \"Active Risk\", \"Remediation Hub\", \"scan engine\", \"InsightConnect\", \"Rapid7 dashboard\".

Expert agent for Recorded Future Intelligence Cloud. Covers Collective Insights AI/NLP analysis, Intelligence Cards, risk scoring, Identity Intelligence, Vulnerability Intelligence, Brand Intelligence, SIEM/SOAR integration, and the RF browser extension. WHEN: \"Recorded Future\", \"RF\", \"Intelligence Card\", \"Collective Insights\", \"risk score\", \"RF Portal\", \"Recorded Future API\", \"RF Intelligence\", \"Mastercard threat intel\".

Expert agent for Rubrik Security Cloud and CDM. Covers immutable filesystem, anomaly detection, threat hunting with YARA/IOCs, data classification, orchestrated recovery, Polaris GPS policy management, and ransomware resilience. WHEN: \"Rubrik\", \"CDM\", \"Rubrik Cloud Data Management\", \"Polaris\", \"Rubrik Security Cloud\", \"Live Mount\", \"threat hunting\", \"anomaly detection\", \"Rubrik cluster\", \"data classification\".

Expert agent for SailPoint IdentityNow and Atlas platform. Provides deep expertise in identity governance, access certifications, lifecycle management, role mining, SOD policies, provisioning connectors, and IdentityAI risk scoring. WHEN: \"SailPoint\", \"IdentityNow\", \"IGA\", \"access certification\", \"role mining\", \"separation of duties\", \"SOD\", \"entitlement management\", \"SailPoint Atlas\", \"IdentityAI\", \"access request\".

Expert routing agent for Static Application Security Testing (SAST). Covers code scanning fundamentals, taint analysis, CI/CD integration patterns, and quality gate design. Routes to SonarQube, Checkmarx, Semgrep, Snyk Code, and Veracode. WHEN: \"SAST\", \"static analysis\", \"code scanning\", \"taint analysis\", \"security hotspot\", \"false positive tuning\", \"CI security gate\", \"IDE security plugin\", \"custom security rules\". Do NOT use for tool-specific questions -- use the `sonarqub...

Expert routing agent for Software Composition Analysis (SCA). Covers open source vulnerability management, CVE/CVSS scoring, license compliance, SBOM generation, reachability analysis, and dependency update automation. Routes to Snyk OSS, Dependabot, Mend, and Black Duck. WHEN: \"SCA\", \"software composition analysis\", \"open source vulnerabilities\", \"dependency scanning\", \"CVE\", \"SBOM\", \"license compliance\", \"supply chain security\", \"transitive dependencies\", \"dependency upda...

Routing agent for Secrets & Certificate Management. Delegates to specialist agents for HashiCorp Vault, Azure Key Vault, AWS Secrets Manager, CyberArk, Doppler, Infisical, 1Password, SOPS, and PKI/certificate tooling. WHEN: \"secrets management\", \"secret rotation\", \"certificate management\", \"PKI\", \"key vault\", \"HSM\", \"envelope encryption\", \"credential storage\". Do NOT use for platform-specific questions -- use the `vault`, `azure-key-vault`, `aws-secrets`, `cyberark`, `doppler`...

Expert agent for Semgrep static analysis. Covers rule syntax (patterns, metavariables, taint tracking), custom rule authoring, autofix, Semgrep Supply Chain, Semgrep Secrets, CI/CD integration, and Semgrep Cloud. WHEN: \"Semgrep\", \"semgrep rule\", \"semgrep pattern\", \"metavariable\", \"semgrep-action\", \"semgrep supply chain\", \"semgrep secrets\", \"custom SAST rule\", \"SARIF\", \"semgrep scan\".

Expert agent for Microsoft Sentinel Playbooks (Azure Logic Apps). Provides deep expertise in automation rules, Logic Apps designer, incident/entity triggers, 200+ connectors, managed identity authentication, ARM templates, and cost-effective automation patterns for Sentinel incidents. WHEN: \"Sentinel playbook\", \"Logic Apps security\", \"automation rule\", \"Sentinel automation\", \"incident trigger\", \"entity trigger\", \"Sentinel SOAR\", \"Logic App connector\".

Expert agent for Microsoft Sentinel. Provides deep expertise in KQL query development, analytics rules, ASIM normalization, data connectors, UEBA, automation rules, playbooks, content hub, multi-workspace architecture, and cost optimization with log tiers. WHEN: \"Sentinel\", \"Microsoft Sentinel\", \"KQL\", \"analytics rule\", \"ASIM\", \"Fusion\", \"UEBA\", \"content hub\", \"Sentinel playbook\", \"Defender portal\", \"Log Analytics workspace\".

Expert agent for SentinelOne Singularity EDR platform. Covers Storyline technology, autonomous response, 1-click rollback, Deep Visibility threat hunting, Purple AI, Ranger network discovery, and STAR rules. WHEN: \"SentinelOne\", \"Singularity\", \"Storyline\", \"Deep Visibility\", \"Purple AI\", \"1-click rollback\", \"Ranger\", \"STAR rule\", \"S1 agent\".

Expert agent for ServiceNow GRC (IRM). Covers Risk Management, Policy and Compliance Management, Audit Management, Vendor Risk Management, Continuous Authorization and Monitoring, integration with ITSM/SecOps, and Now Platform configuration. WHEN: \"ServiceNow GRC\", \"ServiceNow IRM\", \"ServiceNow risk\", \"ServiceNow compliance\", \"ServiceNow audit\", \"Now Platform GRC\", \"ServiceNow vendor risk\", \"Policy and Compliance ServiceNow\".

Routing agent for SIEM & SOAR technologies. Cross-platform expertise in log management, event correlation, detection engineering, normalization, SIGMA rules, and security orchestration. WHEN: \"SIEM comparison\", \"which SIEM\", \"log management\", \"detection engineering\", \"SIGMA rules\", \"security analytics\", \"correlation rules\", \"SOAR platform\", \"security automation\", \"alert triage\". Do NOT use for platform-specific questions -- use the `splunk`, `sentinel`, `elastic-security`,...

Expert agent for smallstep step-ca and step CLI. Covers lightweight internal PKI, OIDC-based certificate issuance, short-lived certificates, SSH certificates (user and host), Kubernetes integration, ACME support, and zero-trust patterns. WHEN: \"smallstep\", \"step-ca\", \"step CLI\", \"step certificate\", \"SSH certificate authority\", \"OIDC certificate\", \"short-lived cert\", \"step-ca ACME\", \"step-ca Kubernetes\".

Expert agent for Snort 3 IDS/IPS. Covers Snort 3 architecture (inspectors, codecs, DAQ), rule syntax with sticky buffers and service keyword, OpenAppID, hyperscan, Talos rule updates, and migration from Snort 2. WHEN: \"Snort\", \"Snort 3\", \"Snort rule\", \"Talos rules\", \"OpenAppID\", \"DAQ\", \"Snort inspector\", \"snort.lua\", \"Snort 2 migration\", \"hyperscan\".

Expert agent for Snyk Code AI-powered SAST. Covers DeepCode engine, real-time IDE scanning, data-flow analysis, auto-fix suggestions, Priority Score, and Snyk platform integration. WHEN: \"Snyk Code\", \"Snyk SAST\", \"DeepCode\", \"Snyk IDE plugin\", \"snyk code test\", \"Snyk Priority Score\", \"Snyk fix\", \"Snyk AppRisk\".

Expert agent for Snyk Open Source SCA. Covers vulnerability detection, auto-fix PRs, license compliance, reachability analysis, SBOM generation, Snyk CLI, CI/CD integration, and the Snyk platform ecosystem. WHEN: \"Snyk Open Source\", \"Snyk OSS\", \"snyk test\", \"snyk monitor\", \"snyk fix\", \"Snyk auto-fix\", \"Snyk license compliance\", \"Snyk vulnerability database\", \"snyk-to-html\".

Expert agent for Snyk developer security platform. Covers Snyk Code (SAST), Snyk Open Source (SCA), Snyk Container, Snyk IaC, Snyk AppRisk (ASPM), IDE plugins, CLI, CI/CD integration, and auto-fix PRs. WHEN: \"Snyk\", \"Snyk Code\", \"Snyk Open Source\", \"Snyk Container\", \"Snyk IaC\", \"SCA\", \"dependency scanning\", \"Snyk CLI\", \"auto-fix PR\", \"AppRisk\".

Routing agent for SOAR (Security Orchestration, Automation, and Response) platforms. Cross-platform expertise in playbook design, integration architecture, automation strategy, and SOAR platform comparison. WHEN: \"SOAR comparison\", \"which SOAR\", \"playbook design\", \"security automation\", \"orchestration platform\", \"automated response\", \"SOAR strategy\", \"SOAR integration\", \"automation maturity\". Do NOT use for platform-specific questions -- use the `xsoar`, `splunk-soar`, `sent...

Expert agent for SonarQube and SonarCloud. Covers quality gates, quality profiles, Clean Code taxonomy, SonarScanner setup, branch analysis, PR decoration, Security Hotspots, taint analysis, and OWASP/CWE mappings. WHEN: \"SonarQube\", \"SonarCloud\", \"SonarLint\", \"quality gate\", \"quality profile\", \"sonar-project.properties\", \"SonarScanner\", \"Security Hotspot\", \"new code period\", \"clean code\".

Expert agent for Sophos Intercept X EDR. Covers deep learning malware detection, CryptoGuard anti-ransomware, exploit prevention, Adaptive Attack Protection, Sophos Central management, Sophos MDR service, and EDR/XDR capabilities. WHEN: \"Sophos\", \"Intercept X\", \"Sophos Central\", \"CryptoGuard\", \"Sophos EDR\", \"Sophos MDR\", \"deep learning detection\", \"Sophos XDR\", \"Sophos MTR\".

Expert agent for Mozilla SOPS (Secrets OPerationS). Covers file encryption (YAML/JSON/ENV/INI), AWS KMS, GCP KMS, Azure Key Vault, age, and PGP backends, partial file encryption, GitOps patterns, and Flux/ArgoCD integration. WHEN: \"SOPS\", \"Mozilla SOPS\", \"sops encrypt\", \"sops decrypt\", \"GitOps secrets\", \"age encryption\", \"SOPS ArgoCD\", \"SOPS Flux\", \"encrypted yaml git\".

Splunk Enterprise Security (ES), the premium SIEM app on top of Splunk: correlation searches, notable events, risk-based alerting (RBA), MITRE ATT&CK framework mapping, adaptive response actions, asset/identity correlation, threat intelligence framework, and ES content management. WHEN: \"Splunk ES\", \"Enterprise Security\", \"notable events\", \"risk-based alerting\", \"RBA\", \"correlation search\", \"adaptive response\", \"glass tables\", \"investigation workbench\", \"ES content update\"...

Expert agent for Splunk SOAR (formerly Phantom). Provides deep expertise in visual playbook development, 300+ apps with 2,800+ actions, container-based incident architecture, case management, custom app development, and Splunk Enterprise Security integration. WHEN: \"Splunk SOAR\", \"Phantom\", \"Splunk playbook\", \"SOAR app\", \"Splunk SOAR container\", \"Phantom playbook\", \"Splunk automation\", \"SOAR visual editor\".

Splunk as a SIEM/security platform across all versions (9.x-10.x): SPL query development for security detection, indexer/search head architecture, forwarder management, SmartStore, CIM normalization for security data models, knowledge objects, and deployment at scale. WHEN: \"Splunk\", \"SPL\", \"search head\", \"indexer\", \"forwarder\", \"SmartStore\", \"Splunkbase\", \"props.conf\", \"transforms.conf\", \"data model\", \"saved search\". Do NOT use for general log/metrics observability, IT ...